Software for advanced execution path inspection

Abstract

Execution path is a subset of code that gets executed during operation of software. Inspection of the execution path is often required when analysing software for vulnerabilities. This thesis describes Triggerfow, a tool for tracking execution paths, that can be used to facilitate such inspection. Triggerfow works by leveraging debugger to dynamically analyze code execution and fltering results using source code annotations. The thesis describes the tool interface, engineering choices made during its development, techniques it uses, and supporting software and methodology of deploying continuous integration using this software. Triggerfow was originally developed for detecting side-channel vulnerabilities in OpenSSL. The work on Triggerfow led to a conference publication at DIMVA 2019, main author being the author of this thesis. The conference paper is included as appendix A